Nasscom to plug security holes in BPO

Indian IT and BPO industry is perhaps the most secure with the best of global standards to address issues of data and information security. Yet, security continues to be one of the biggest challenges before the industry, especially as more banks and institutions look at outsourcing tasks to India. Clearly, investments in security by service providers will drive the offshoring game.

Industry body Nasscom is looking at creating a new globally credible information security standard that takes cognizance of the changing global sourcing environment. It could add to existing standards like BS7799 and ISO 17799.

Such a standard will also help the industry to further attest to its credentials. The BPO industry is growing fast at over 35% a year and does some critical jobs in areas spanning healthcare, banking, telecom, automobile (like design services) and legal services. For instance, about 8% of the US banking transactions are settled in India. That easily runs into several billion dollars. In the next four years, this will increase to about 30%, reckons Nasscom.

Standard Chartered Bank, Bank of America, HSBC, Deutsche Bank, ABN Amro, Wells Fargo, JP Morgan, Morgan Stanley have outsourced their operations here. Many more will soon offshore to India.
“There is a lot more diverse information going back and forth. India is at least as safe — and in many cases safer — than most other countries. But we need to continuously strengthen security and feel that creating a new globally credible standard is an essential next step towards strengthening information security,’’ Nasscom president Kiran Karnik said.

Tholons (an advisory firm) CEO Avinash Vashistha adds, “In the last six to nine months the level of security has gone up. SAS70 audits and Sox compliances are mandatory now. I see Indian vendors investing more on security. At present, the US and European companies spend about 15% of their IT budgets on security while Indian vendors spend less than 5% on security. This will go up.”

The existing standards, says Nasscom, are either technologyfocused or are process driven. “This needs to be integrated with the global laws under the proposed standards,” Nasscom Vice President Sunil Mehta said while talks with universities and security experts were on, it would take the industry about two years to evolve such standards.

Meanwhile, Nasscom said that the proposed Self Regulatory Organisation (SRO) aimed at monitoring and enforcing privacy and data protection standards for IT and BPO industry would be in place in the next three to six years.